A crafted file processed by macOS can trigger a crash of the responsible application, resulting in termination without corrupting system data. The vulnerability stems from improper bounds checking, which aligns with CWE‑787. Because the failure occurs during parsing, an attacker can make the application exit unexpectedly, disrupting user activity or services that rely on that application.

Apple’s macOS operating systems are affected. Versions older than macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.5 remain vulnerable. The fixed releases listed as Sequoia 15.3, Sonoma 14.7.3, Ventura 13.7.3 and Ventura 13.7.5 all contain the necessary checks that prevent the crash.

The CVSS score of 7.8 indicates a high severity for denial of service. The EPSS score of less than 1 % suggests a very low likelihood of widespread exploitation in the near future, and the vulnerability is not listed in the CISA KEV catalog. Exploitation appears to require the delivery of a maliciously crafted file to the target machine, typically via download or email attachment, and then opening it with the vulnerable application. As such, the attack vector is likely local or remote through user interaction, but no public exploit is currently known.